flutter_ssl_pinning_client

An enterprise-grade SSL/TLS Certificate & SPKI Public Key Pinning client for Flutter & Dart. Protects mobile applications against Man-In-The-Middle (MITM) proxy attacks, proxy interception, and rogue certificate authorities.

🌟 Key Features

• 🔒 SPKI & Certificate SHA-256 Pinning: Pins server public key Subject Public Key Info (SPKI) or DER certificate SHA-256 fingerprints.
• 🔄 Backup Pinning & Key Rotation: Supports primary + backup pins to allow seamless server SSL certificate rotation without breaking legacy app builds.
• 🌐 Wildcard Domain Matching: Match specific hosts (api.bank.com) or wildcard patterns (*.bank.com).
• 🛑 Strict & Report-Only Modes: Immediately terminate invalid TLS handshakes or log security violations to backend telemetry in reportOnly mode.
• 🛠️ Seamless http.BaseClient Drop-In: Directly extends standard http.BaseClient.

📦 Installation

Add flutter_ssl_pinning_client to your pubspec.yaml:

dependencies:
  flutter_ssl_pinning_client: ^1.0.2

🚀 Quick Start

import 'package:flutter_ssl_pinning_client/flutter_ssl_pinning_client.dart';

final client = SslPinningHttpClient(
  config: SslPinningConfig(
    mode: EnforceMode.strict,
    onPinningFailure: (domain, fingerprint) {
      print('SECURITY ALERT: MITM Attack attempt on $domain (Fingerprint: $fingerprint)');
    },
    domainConfigs: {
      'api.bank.com': const DomainPinConfig(
        domain: 'api.bank.com',
        allowedSHA256Pins: {
          'sha256/7130325d70678f564757c2a71f008801d9f67822998f45a49c362947d95393c5',
          'sha256/backup_pin_hash_here...',
        },
      ),
    },
  ),
);

// Standard http request protected by SSL Pinning
final response = await client.get(Uri.parse('https://api.bank.com/account'));

📄 License

MIT License - Developed with ❤️ by Olamilekan Adeyemi (@lekthedeveloper).